39.8. Creating Capabilities-Only Environments

In the preceding pages, we have described various ways in which a process with the user ID 0 (root) is treated specially with respect to capabilities:

• When a process with one or more user IDs that equal 0 sets all of its user IDs to nonzero values, its permitted and effective capability sets are cleared. (See Section 39.6.)

• When a process with an effective user ID of 0 changes that user ID to a nonzero value, it loses its effective capabilities. When the reverse change is made, the permitted capability set is copied to the effective set. A similar procedure is followed for a subset of capabilities when the process’s file-system user ID is switched between 0 and nonzero values. (See Section 39.6.)

• If a process with real or effective user ID of root execs a program, or any process execs a set-user-ID-root program, then the file inheritable and permitted sets are notionally defined to be all ones. If the process’s effective user ID is 0, or it is execing a set-user-ID-root program, then the file effective bit is notionally defined to be 1. (See Section 39.5.2.) In the usual cases (i.e., both the real and effective user ID are root, or a set-user-ID-root program is being execed), this means the process gets all capabilities in its permitted and effective sets.